Skip to the content
The Update Bureau
SharePoint Server 2019 SharePoint Server 2019 Security update
Patch Tuesday

KB5002825

KB5002825: Cumulative update for SharePoint Server, version 2019, January 2026. Remote code execution flaws resolved; RBS migration duplication fixed

In short

The update resolves seven Important vulnerabilities and fixes a China certification issue and duplicate data during Remote Blob Storage migration.

Does it affect you? Applies to: SharePoint Server 2019 farms running the release version of the product.

Build
16.0.10417.20083
Security
7 fixed
Restart
Required

Microsoft ships this release as two packages: KB5002825, the update itself, and KB5002823 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

Fixes 3 changes

SharePoint Server security

For: SharePoint farm administrators

  • The update resolves vulnerabilities involving elevation of privilege, remote code execution, information disclosure, and spoofing.1
    The listed vulnerability areas include Microsoft Office Click-To-Run, SharePoint, Word, and SharePoint Server.

GB18030-2022 certification

For: SharePoint farm administrators

  • The GB18030-2022 China certification issue is fixed.2

Remote Blob Storage migration

For: SharePoint farm administrators

  • Data duplication during Remote Blob Storage migration is fixed.3

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-01-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002816, KB5002803, KB5002796, KB5002775
+3 earlier KB5002769, KB5002754, KB5002741
Replaced by
KB5002834
VersionBuildChannel
2019 16.0.10417.20083 General availability

Security

7 vulnerabilities fixed
7 important
VulnerabilitySeverityCVSS
CVE-2026-20963
Microsoft SharePoint Remote Code Execution Vulnerability
 Important 9.8
CVE-2026-20947
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-20948
Microsoft Word Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-20951
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-20943
Microsoft Office Click-To-Run Remote Code Execution Vulnerability
 Important 7.0
CVE-2026-20958
Microsoft SharePoint Information Disclosure Vulnerability
 Important 5.4
CVE-2026-20959
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6

Updated components

446 files changed since the previous update for the same versions.

Top changed componentsFiles
Search44
Project Server23
Document conversion20
Client object model9
Access Services8
Document management and policies6
Managed metadata5
Office web apps3
PowerPoint3
PowerShell2
Publishing2
Translation Services2

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This security update resolves Microsoft Office Click-To-Run Elevation of Privilege vulnerability, Microsoft SharePoint Remote Code Execution vulnerability support.microsoft.com
  2. 2. This update fixes the GB18030-2022 China certification issue. support.microsoft.com
  3. 3. This update fixes the data duplication issue that occurs during the Remote Blob Storage (RBS) migration. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake